mirror of
https://gitee.com/niucloud-team/niucloud.git
synced 2026-09-19 10:26:38 +00:00
262 lines
8.4 KiB
PHP
262 lines
8.4 KiB
PHP
<?php
|
||
// +----------------------------------------------------------------------
|
||
// | Niucloud-admin 企业快速开发的saas管理平台
|
||
// +----------------------------------------------------------------------
|
||
// | 官方网址：https://www.niucloud.com
|
||
// +----------------------------------------------------------------------
|
||
// | niucloud团队 版权所有 开源版本可自由商用
|
||
// +----------------------------------------------------------------------
|
||
// | Author: Niucloud Team
|
||
// +----------------------------------------------------------------------
|
||
|
||
namespace app\service\admin\auth;
|
||
|
||
use app\dict\site\SiteDict;
|
||
use app\dict\sys\AppTypeDict;
|
||
use app\model\sys\SysUserRole;
|
||
use app\Request;
|
||
use app\service\admin\site\SiteUserService;
|
||
use app\service\admin\sys\MenuService;
|
||
use app\service\admin\sys\RoleService;
|
||
use app\service\admin\user\UserRoleService;
|
||
use app\service\admin\user\UserService;
|
||
use app\service\core\niucloud\CoreAuthService;
|
||
use app\service\core\site\CoreSiteService;
|
||
use core\base\BaseAdminService;
|
||
use core\exception\AuthException;
|
||
use core\exception\CommonException;
|
||
use Exception;
|
||
use think\facade\Cache;
|
||
|
||
/**
|
||
* 用户服务层
|
||
* Class AuthService
|
||
* @package app\service\admin\auth
|
||
*/
|
||
class AuthService extends BaseAdminService
|
||
{
|
||
/**
|
||
* 校验用户和传入站点是否存在从属关系
|
||
* @param Request $request
|
||
* @return true
|
||
*/
|
||
public function checkSiteAuth(Request $request)
|
||
{
|
||
$site_id = $request->adminSiteId();
|
||
//todo 将站点编号转化为站点id
|
||
$site_info = (new CoreSiteService())->getSiteCache($site_id);
|
||
//站点不存在
|
||
if (empty($site_info)) throw new AuthException('SITE_NOT_EXIST');
|
||
//没有当前站点的信息
|
||
if (!AuthService::isSuperAdmin()) {
|
||
if (!$this->getAuthRole($site_id)) throw new AuthException('NO_SITE_PERMISSION');
|
||
}
|
||
|
||
$request->siteId($site_id);
|
||
$request->appType($site_info['app_type']);
|
||
return true;
|
||
}
|
||
|
||
|
||
/**
|
||
* 校验权限
|
||
* @param Request $request
|
||
* @return bool
|
||
* @throws Exception
|
||
*/
|
||
public function checkRole(Request $request)
|
||
{
|
||
$this->checkAuthinfo($request);
|
||
|
||
$rule = strtolower(trim($request->rule()->getRule()));
|
||
$method = strtolower(trim($request->method()));
|
||
$site_info = (new AuthSiteService())->getSiteInfo();
|
||
if ($method != 'get') {
|
||
// throw new AuthException('演示站禁止操作');
|
||
if ($site_info[ 'status' ] == SiteDict::EXPIRE) throw new AuthException('SITE_EXPIRE_NOT_ALLOW');
|
||
if ($site_info[ 'status' ] == SiteDict::CLOSE) throw new AuthException('SITE_CLOSE_NOT_ALLOW');
|
||
}
|
||
|
||
$menu_service = new MenuService();
|
||
$all_menu_list = $menu_service->getAllApiList($this->app_type);
|
||
//先判断当前访问的接口是否收到权限的限制
|
||
$method_menu_list = $all_menu_list[$method] ?? [];
|
||
if (!in_array($rule, $method_menu_list)) {
|
||
$other_menu_list = $menu_service->getAllApiList($this->app_type == AppTypeDict::ADMIN ? AppTypeDict::SITE : AppTypeDict::ADMIN);
|
||
$method_menu_list = $other_menu_list[$method] ?? [];
|
||
if (!in_array($rule, $method_menu_list)) {
|
||
return true;
|
||
} else {
|
||
throw new AuthException('NO_PERMISSION');
|
||
}
|
||
}
|
||
|
||
$auth_role_list = $this->getAuthApiList();
|
||
if (!empty($auth_role_list[$method]) && in_array($rule, $auth_role_list[$method]))
|
||
return true;
|
||
|
||
throw new AuthException('NO_PERMISSION');
|
||
|
||
}
|
||
|
||
public function checkAuthinfo(Request $request) {
|
||
$rule = strtolower(trim($request->rule()->getRule()));
|
||
$method = strtolower(trim($request->method()));
|
||
|
||
if ($method == 'get') return;
|
||
|
||
$ignore = ['niucloud/authinfo', 'upgrade', 'niucloud/build', 'sys/cache/clear'];
|
||
foreach ($ignore as $item) {
|
||
if (strpos($rule, $item) !== false) return;
|
||
}
|
||
|
||
$authinfo = [];
|
||
try {
|
||
$authinfo = (new CoreAuthService())->getAuthInfo()['data'] ?? [];;
|
||
} catch (Exception $e) {
|
||
}
|
||
if (empty($authinfo)) return;
|
||
|
||
if (!$this->isCheckDomain()) return;
|
||
|
||
$site_address = $authinfo['site_address'] ?? '';
|
||
$domain = request()->domain();
|
||
|
||
// 如果是站点域名不进行验证
|
||
$site_id = (new CoreSiteService())->getSiteIdByDomain($domain);
|
||
if (!empty($site_id)) return;
|
||
|
||
if (!empty($site_address) && strpos($domain, $site_address) !== false) return;
|
||
|
||
throw new CommonException("授权域名校验失败！请确保当前访问域名与授权码绑定的域名一致");
|
||
}
|
||
|
||
private function isCheckDomain() {
|
||
return !(request()->ip() == '127.0.0.1' || request()->host() == 'localhost');
|
||
}
|
||
|
||
/**
|
||
* 获取授权用户的权限信息
|
||
* @return mixed
|
||
*/
|
||
public function getAuthRole(int $site_id)
|
||
{
|
||
$user_role_service = new UserRoleService();
|
||
return $user_role_service->getUserRole($site_id, $this->uid);
|
||
}
|
||
|
||
/**
|
||
* 当前授权用户接口权限
|
||
* @return array
|
||
*/
|
||
public function getAuthApiList()
|
||
{
|
||
if (AuthService::isSuperAdmin()) {
|
||
$is_admin = 1;
|
||
} else {
|
||
$user_role_info = $this->getAuthRole($this->site_id);
|
||
if (empty($user_role_info))
|
||
return [];
|
||
|
||
$is_admin = $user_role_info['is_admin'];//是否是超级管理员组
|
||
}
|
||
|
||
$menu_service = new MenuService();
|
||
if ($is_admin) {//查询全部启用的权限
|
||
//获取站点信息
|
||
return (new AuthSiteService())->getApiList(1);
|
||
} else {
|
||
$user_role_ids = $user_role_info['role_ids'];
|
||
$role_service = new RoleService();
|
||
$menu_keys = $role_service->getMenuIdsByRoleIds($this->site_id, $user_role_ids);
|
||
|
||
return $menu_service->getApiListByMenuKeys($menu_keys, $this->app_type);
|
||
}
|
||
|
||
}
|
||
|
||
/**
|
||
* 当前授权用户菜单权限
|
||
* @return array
|
||
*/
|
||
public function getAuthMenuList(int $is_tree = 0, $addon = 'all')
|
||
{
|
||
if (AuthService::isSuperAdmin()) {
|
||
$is_admin = 1;
|
||
} else {
|
||
$user_role_info = $this->getAuthRole($this->site_id);
|
||
if (empty($user_role_info))
|
||
return [];
|
||
$is_admin = $user_role_info['is_admin'];//是否是超级管理员组
|
||
}
|
||
|
||
$menu_service = new MenuService();
|
||
if ($is_admin) {
|
||
// 查询全部启用的权限
|
||
$menu_list = (new MenuService())->getAllMenuList($this->app_type, 1, $is_tree, 1);
|
||
} else {
|
||
$user_role_ids = $user_role_info['role_ids'];
|
||
$role_service = new RoleService();
|
||
$menu_keys = $role_service->getMenuIdsByRoleIds($this->site_id, $user_role_ids);
|
||
$menu_list = $menu_service->getMenuListByMenuKeys($this->site_id, $menu_keys, $this->app_type, $is_tree, $addon);
|
||
}
|
||
return $menu_list;
|
||
}
|
||
|
||
/**
|
||
* 获取授权用户信息
|
||
*/
|
||
public function getAuthInfo()
|
||
{
|
||
return (new SiteUserService())->getInfo($this->uid);
|
||
}
|
||
|
||
/**
|
||
* 修改用户权限
|
||
* @param string $field
|
||
* @param $data
|
||
* @return bool
|
||
*/
|
||
public function modifyAuth(string $field, $data)
|
||
{
|
||
return (new SiteUserService())->modify($this->uid, $field, $data);
|
||
}
|
||
|
||
/**
|
||
* 修改用户
|
||
* @param array $data
|
||
* @return true
|
||
*/
|
||
public function editAuth(array $data)
|
||
{
|
||
if (!empty($data['password'])) {
|
||
//检测原始密码是否正确
|
||
$user = (new UserService())->find($this->uid);
|
||
if (!check_password($data['original_password'], $user->password))
|
||
throw new AuthException('OLD_PASSWORD_ERROR');
|
||
|
||
}
|
||
return (new UserService())->edit($this->uid, $data);
|
||
}
|
||
|
||
/**
|
||
* 是否是超级管理员
|
||
* @return bool
|
||
*/
|
||
public static function isSuperAdmin()
|
||
{
|
||
$super_admin_uid = Cache::get('super_admin_uid');
|
||
|
||
if (!$super_admin_uid) {
|
||
$super_admin_uid = (new SysUserRole())->where([
|
||
['site_id', '=', request()->defaultSiteId()],
|
||
['is_admin', '=', 1]
|
||
])->value('uid');
|
||
Cache::set('super_admin_uid', $super_admin_uid);
|
||
}
|
||
|
||
return $super_admin_uid == (new self())->uid;
|
||
}
|
||
|
||
}
|